Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently setup centralized authentication system using OpenLDAP. Now I need to extend the users that are defined in the database to include a new object class that contains some security related data about them. How can I modify the existing entries to add this new object class? I'm pretty new to LDAP so don't bite my head off if I managed to ask a stupid question :P Thanks!

share|improve this question
up vote 1 down vote accepted

You can run ldapmodify to modify one or more entries, you just need to feed to the program the credentials and a file containing all the changes you want to do

As an example (taken straight from openldap manual), if your file contains this it'll add/modify all those fields

dn: uid=john.doe,ou=People,dc=example,dc=com
changetype: add
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: john.doe
givenName: John
sn: Doe
cn: John Doe
userPassword: password
share|improve this answer
Thanks it worked like a charm, after I figured out how to defined the adding operation, of course (it differs for adding an attribute). It goes like this (perhaps somebody has a use for it also): dn: uid=john.doe,ou=People,dc=example,dc=com changetype: add add: objectClass objectClass: person -- snip -- – crazybyte Jan 22 '11 at 22:00

OpenLdap Schema and ObjectClass are easy to extend. Look inside bundled schema if there is the object of your needs (located, on a debian filesystem is /etc/ldap/schema)

After you can modify your ldap entities and attached to them new objectClass (and, by extension, new attribute types).

If you want to build your own attribute type and/or your own objectClass you need to request an OID object number (OID Registration).

Then follow this schema :

objectIdentifier YOUR_OID <IANA NUMBER>

Then define your attribute type:

attributetype( YOUR_ATTRIBUTETYPE:1 NAME "your attribute name"
    DESC "quick description"
    EQUALITY typoofequality
    SYNTAX valid syntax

And your object class:

objectclass(YOUR_OBJECTCLASSS:1 NAME "your objectclass name"
    DESC "quick description"
    SUP top #or another objectclass inheritence
    MUST (list of must attributes, separated by "$")
    MAY (list of may attributes, separated by "$") )

The number following the YOUR_ATTRIBUTETYPE/YOUR_OBJECTCLASS must be unique (ie : one number for each attribute)

For reference, have a look at Open LDAP Schema Specification

share|improve this answer
The issue was that I didn't know how to attach/add a new objectClass to an already existing entry/entries. – crazybyte Jan 22 '11 at 21:26
Thank you anyway! :) – crazybyte Jan 22 '11 at 22:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.